Can CVE-2021-44228 (Log4Shell) be mitigated by setting the log level to OFF?

"Sander, Uwe" <[email protected]> Mon, 13 Dec 2021 15:05:45 +0000

Newsgroups	gmane.comp.jakarta.log4j.user
Message-ID	<AM9P190MB16206B245E0770276B606DF385749@AM9P190MB1620.EURP190.PROD.OUTLOOK.COM>

Hi all,

I have seen multiple ways to mitigate the effects of CVE-2021-44228 (Log4Shell) for different Log4J 2.x versions. One thing I have not seen is to set the log level to OFF. This would effectively disable logging, of course, but it might be a temporary mitigation that works for us.

Can anyone confirm that setting the log level to OFF closes the attack vector effectively?

Thanks,
Uwe